@appxdigital/appx-core 0.1.121-beta.6 → 0.1.121-beta.7

package/PRERELEASES.md

@@ -23,6 +23,17 @@ Prereleases are excluded from normal semver range resolution, so a project on
 
 ---
 
+## [0.1.121-beta.7] — unreleased
+
+**Library.** `createMany` now inherits the `create` permission when not declared
+explicitly — in both the data-access proxy and the `RbacGuard`. A
+`permissions.config.ts` can declare a single `create` rule and have it cover
+`createMany` too (mirrors the existing `findMany → count/findFirst` fallback).
+One-directional: declaring only `createMany` does **not** enable `create`.
+
+- If you previously duplicated `create` and `createMany`, the `createMany` entry
+  is now redundant (harmless to keep). No action required.
+
 ## [0.1.121-beta.6] — unreleased
 
 **Packaging.** The npm tarball now ships `CHANGELOG.md`, `PRERELEASES.md`, and

package/dist/common/guards/rbac.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/rbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,gBAAgB,EAInB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAC,qBAAqB,EAAkB,MAAM,kCAAkC,CAAC;AAExF,qBACa,SAAU,YAAW,WAAW;IAErC,OAAO,CAAC,SAAS;IACiB,OAAO,CAAC,iBAAiB;gBADnD,SAAS,EAAE,SAAS,EACc,iBAAiB,EAAE,qBAAqB;IAGhF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAoCjE"}
+{"version":3,"file":"rbac.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/rbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,gBAAgB,EAInB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAC,qBAAqB,EAAkB,MAAM,kCAAkC,CAAC;AAExF,qBACa,SAAU,YAAW,WAAW;IAErC,OAAO,CAAC,SAAS;IACiB,OAAO,CAAC,iBAAiB;gBADnD,SAAS,EAAE,SAAS,EACc,iBAAiB,EAAE,qBAAqB;IAGhF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA0CjE"}

package/dist/common/guards/rbac.guard.js

@@ -38,7 +38,13 @@ let RbacGuard = exports.RbacGuard = class RbacGuard {
         if (!rolePermissions) {
             throw new common_1.ForbiddenException(`No permissions defined for role ${user.role} on model ${model}`);
         }
-        const permission = rolePermissions[action];
+        // `createMany` inherits the `create` rule when not defined explicitly —
+        // mirrors the data-access proxy, which validates each batched row against
+        // the `create` permission. Lets a config declare just `create`.
+        let permission = rolePermissions[action];
+        if (!permission && action === 'createMany') {
+            permission = rolePermissions['create'];
+        }
         if (!permission) {
             throw new common_1.ForbiddenException(`Action ${action} not allowed for role ${user.role} on model ${model}`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.121-beta.6",
+    "version": "0.1.121-beta.7",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",